Website privacy notice

Who we are and what this notice covers

Deyora Intelligence Private Limited (“Deyora”, “we”, “us”) is a company incorporated in India (CIN U62010RJ2026PTC114088), with its registered office at B-195, Shastri Nagar, Bhilwara, Rajasthan 311001, India. Our product is DokyDoc.

This notice explains how we handle personal data when:

• you visit this website, deyoraintelligence.com;
• you send us the contact form on this website, or email us;
• we contact you for business, for example to introduce DokyDoc.

For this personal data, Deyora is the Data Fiduciary: we decide why and how it is used.

The DokyDoc Privacy Policy applies when you use DokyDoc. It covers Account Data (data about DokyDoc accounts, their Authorised Users, billing and the use of DokyDoc) and Customer Content (everything an organisation or its Authorised Users upload, connect or create in DokyDoc, and the results DokyDoc derives from it). Its Personal Data We Handle list sets out, item by item, the personal data DokyDoc handles, including enquiries and the people we contact about DokyDoc. This notice also covers the other people we contact for business and the emails people send us. If either describes the data in this notice differently, this notice applies and we correct the other.

We follow India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it as each provision comes into force, and the other Indian laws that apply to us, including the Information Technology Act, 2000 and its rules. A section number in this notice, such as s.7(a), is a section of the DPDP Act. A Data Principal is the person the personal data is about, a Data Processor handles personal data on behalf of a Data Fiduciary, and the Board is the Data Protection Board of India.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Website visitors

When you open a page, your browser sends what every website receives: your IP address, details of your browser and device, the address of the page and, often, the website that sent you. It goes first to Cloudflare, which sits in front of this website to carry and protect its traffic, and then to our website host. Both use it to deliver the page and keep the website secure, and keep records of these requests under their own terms. We do not use them to find out who you are, or to follow you across other websites. Our ground is legitimate use under s.7(a): your browser sends this information so that you can see the page.

What this website keeps in your browser

The website keeps a few things in your own browser’s storage, so that it can show you what fits the choices you make. None of it reaches us unless you send the contact form.

• The kind of visitor you said you are, if you choose an option such as “I run a company” or open a link such as /?for=investor. Kept until you clear it.
• The name and company sent with your message, once you send the contact form, so that the website can greet you and fill them in next time. Kept until you clear it.
• This visit: the pages you open, the name of the website that sent you (never the page you were on) and any campaign tags in the link you arrived by, such as utm_source. Kept for this visit only, and gone when you close the tab.

To clear it, use “Forget me in this browser” at the foot of any page once something is stored, or clear this site’s data in your browser.

The links on this website that start or open DokyDoc carry tags saying that you came from this website, and most of them also say the kind of visitor you said you are, if you chose one. They never carry your name or email address.

Cookies and analytics

Apart from what is listed above, this website stores nothing about you on your device, and it sets no cookies of its own. Cloudflare may set a security cookie in your browser if it needs to check that a visitor is a person and not an automated program; the cookie is used only to protect the website.

Cloudflare also adds two small scripts of its own to our pages. If your browser runs it, its Web Analytics script reports how each page loads: the page’s address, the website that sent you, your browser and device type, and how long the page took to load. We see only totals, such as the number of visits to each page. Cloudflare says Web Analytics uses no cookies or other storage in your browser, and does not use your IP address or browser details to identify you. Its email protection script hides our email address from automated programs that collect addresses, and shows it to you.

Apart from these, this website runs no analytics or advertising scripts and loads nothing from other websites: its fonts and images come from this website itself. If we change this, we will update this notice first, and ask for your consent where the law requires it.

The contact form

What you send. Your email address, the two answers you choose, a note if you add one, and the name and company the form shows before you send. The form suggests the name and company from your email address (for example, [email protected] suggests Priya Sharma from Acme). The suggestion is made in your browser, nothing is looked up anywhere, and you can change or remove it before you send.

What the form adds. So that we can reply in context, the form also sends what this website keeps in your browser, apart from your name and company: the kind of visitor you said you are, if you chose one; the pages you opened during this visit; the website that sent you; and any campaign tags. Before you send, the form lists the pages you opened and the website that sent you. Our form provider records your IP address, details of your browser and the page you sent the form from, and checks each message for spam.

Why we use it. To reply to you and, if you ask, to arrange a call or a walkthrough of DokyDoc, or to send you documents you asked for. We do not add you to a mailing list or use your details for advertising.

Our ground. Legitimate use under s.7(a): you give us these details for this purpose. You can tell us at any time that you no longer want us to use them, and we will stop and delete them, unless a law requires us to keep them.

Where it goes. Our form provider keeps your message and emails a copy to our mailbox. “Who receives personal data” names both providers, and “How long we keep data” says when each copy is deleted.

Please do not send confidential documents through the form.

Emails to us

When you email us, or reply to an email from us, we receive your email address, your name as your email shows it, and whatever your message and its attachments contain. We use them to reply and to deal with what you wrote about, such as an enquiry, a request for our security documents, a partnership, an investment, a job at Deyora or a press request, and we keep the correspondence as a record. Our ground is legitimate use under s.7(a). Our email is kept in our mailbox at our email provider.

Some messages are covered elsewhere:

• Emails about a DokyDoc account, including requests for support, are covered by the DokyDoc Privacy Policy.
• If your organisation sends us its business records, for example for a review under a signed non-disclosure agreement, we handle them as its Data Processor, under that agreement and the DokyDoc Privacy Policy.

People we contact for business

We contact people at businesses we think may be interested in our products, and others we approach for our business, such as possible partners and investors. We also talk with people in different businesses about how they work, so that we can build products that help them.

What we hold. Your name, job title, company, work email address, phone number and city; when and how we contacted you; notes of our calls and messages, including what you told us; and whether you asked us not to contact you.

Where it comes from. Business details you made public yourself, or asked to be made public, such as on your company’s website, your professional networking profile or a listing your business published; details you gave us, for example on a business card, at a meeting or event, or in a reply; introductions from people who know you; and business directories and business-contact databases compiled by other organisations.

How we contact you. By email, by phone, or by message through a professional networking or messaging service.

Why we use it. To introduce our products, arrange demonstrations, meetings and pilots, follow up on our conversations and learn what your business needs.

Our ground.

• Business details you made public yourself, or asked to be made public: the DPDP Act does not apply to them (s.3(c)(ii)). We follow this notice for them all the same.
• Details you gave us: legitimate use under s.7(a), for the purpose you gave them for.
• Details we have in any other way, such as through an introduction or from a business directory or database: until 31 March 2027, we may contact you at your work email address or work phone number, saying first who we are and why we are contacting you, and we stop at once if you say no. From 31 March 2027, we contact you only if you have agreed to hear from us after being given this notice, for example through the person who introduced you. That agreement is your consent (s.6), and you can withdraw it at any time.

To stop us. Reply to any message from us, tell us on a call, or write to the grievance officer. We stop contacting you and take you off our outreach list, usually the same day. We keep only your email address or phone number on a do-not-contact list, so that we do not contact you again, and delete your other details from our outreach list and from its earlier versions. Copies that the AI tools named in “Who receives personal data” have already received are kept by those tools under their own terms.

The services that hold these details are named in “Who receives personal data”.

Who receives personal data

These service providers handle personal data for us, under their terms with us:

When we call you, or message you through a professional networking or messaging service, that service carries the call or message under its own terms.

Our own people see this personal data only as their work needs, and our professional advisers see it, under a duty of confidentiality, only where they need it to advise us. We disclose personal data to a court or a public authority only where a law, judgment or order requires it (s.7(d) and s.7(e)). If Deyora’s business is merged, sold or otherwise transferred, the personal data in this notice may pass to the new owner, which may use it only as this notice describes.

Where personal data is kept

Our mailbox is in India. Our website host is based in the United States, Cloudflare handles traffic on its global network, and the code-hosting service and AI tools we use are outside India, so personal data in this notice may be handled outside India. The DPDP Act allows this, except to a country or territory the Government of India restricts by notification (s.16). We will not transfer personal data to a restricted country or territory, and we make no promise that it stays in any one country.

How long we keep data

We make these deletions by hand at a review every three months, so an item can stay up to three months past the time shown. An email that forms part of a tax record, a signed agreement or a dispute is kept for as long as the law, the agreement or the dispute requires. If you become a customer, the DokyDoc Privacy Policy covers your account.

Security

We protect personal data with safeguards suited to the risk. This website and its form work only over encrypted (HTTPS) connections, and only the people at Deyora whose work needs them can open the form messages, our mailbox and our outreach list. If a personal data breach affects your personal data, we will tell you and the Board as the DPDP Act and its rules require. Before those duties come into force, we already tell the people affected in the same way, and we prepare the report the Board will need.

Your rights

You can:

• ask for a summary of the personal data we hold about you and how we use it, and for the identities of the other Data Fiduciaries and Data Processors we have shared it with, with a description of what we shared (s.11);
• ask us to correct, complete or update it, or to erase it (s.12). We erase it unless we need to keep it for the purpose you gave it for or to comply with a law;
• withdraw your consent where we rely on it, as easily as you gave it (s.6), and tell us that you no longer agree to a use where we rely on s.7(a);
• nominate one or more people to use your rights if you die or become unable to act (s.14), by emailing us their names and email addresses;
• have a grievance resolved by our grievance officer (s.13) and, if you are not satisfied, complain to the Board, in the way the Board sets out on its website, once the relevant provisions of the DPDP Act are in force.

Where the DPDP Act does not apply, for example to business details you made public yourself, we answer these requests in the same way.

How to make a request

Write to the grievance officer at [email protected], preferably from the email address you used with us. We may ask you to confirm who you are before we act. We handle these requests manually, by a person. We reply within 30 days, and every reply names the grievance officer and says how to reach them. You can ask for this notice, and for our replies, in English or in any language in the Eighth Schedule to the Constitution of India.

If the GDPR applies to you

If the EU or UK General Data Protection Regulation (the “GDPR”) applies to our handling of your personal data, read Data Fiduciary as “controller”, Data Processor as “processor” and Data Principal as “data subject”. We rely on these legal bases: our legitimate interests in running and protecting this website, answering messages and contacting businesses about our products; consent where we ask for it; and legal obligation for records a law requires us to keep. You have the rights the GDPR gives you, including to object to processing, and you may complain to your supervisory authority.

Children

This website and our products are for businesses, and are not meant for anyone under 18. We do not knowingly collect personal data from children. If you are under 18, please do not send us your details. If we learn that we hold a child’s personal data without the consent the law requires, we will delete it.

Changes to this notice

This page shows its version and the date it took effect, and the change log below records every change with its date. We keep earlier versions and will send any of them on request.

• We may replace a provider in “Who receives personal data” with one that does the same job, and correct or clarify wording, with a dated entry in the change log. A new provider is listed before it receives any personal data, and a correction never widens what we do.
• A change that adds a kind of personal data or a purpose is a new version, published on this page before it takes effect. A change that reduces your rights is published at least 30 days before it takes effect.
• We will not use personal data we already hold for a purpose this notice does not describe, such as a newsletter, without your consent.

Change log

Grievance officer and contact

Our grievance officer is Muskan Shah, Director, reachable at [email protected]. The grievance officer answers questions about how we process personal data, and handles requests, grievances and complaints under this notice. We respond within 30 days.

Deyora Intelligence Private Limited
CIN U62010RJ2026PTC114088
B-195, Shastri Nagar, Bhilwara, Rajasthan 311001, India
[email protected]